oski | bd9cbcbfd7a897facee368f30d798f2b6cf4bb4aaf1b3301de96e691a6a5ce18

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-12-2023 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0446466ac12756312798acc282f43f42.ps1
Size

421KB
MD5

0446466ac12756312798acc282f43f42
SHA1

3fd7350b0fb7a5f6954133aef52225d7d43b3089
SHA256

bd9cbcbfd7a897facee368f30d798f2b6cf4bb4aaf1b3301de96e691a6a5ce18
SHA512

5af139c0d939faab146582a2e539011133f21f5514ec46e9065e1ab04820dd33541eaa90fe2c0b7e1dea8a3aeea0a90a20562dad5598249979e513ede0af333e
SSDEEP

12288:+Zjw0RJ9u5ILYDxD3fxYehza/tw64cL68:q3H

Score

10^/10

oski infostealer

Malware Config

Extracted

Family

oski

/103.114.107.28/l2828/

Signatures

Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2224 set thread context of 2144	2224	powershell.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	2144	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2224	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2224	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2144	2224	powershell.exe	29
PID 2224 wrote to memory of 2144	2224	powershell.exe	29
PID 2224 wrote to memory of 2144	2224	powershell.exe	29
PID 2224 wrote to memory of 2144	2224	powershell.exe	29
PID 2224 wrote to memory of 2144	2224	powershell.exe	29
PID 2224 wrote to memory of 2144	2224	powershell.exe	29
PID 2224 wrote to memory of 2144	2224	powershell.exe	29
PID 2224 wrote to memory of 2144	2224	powershell.exe	29
PID 2224 wrote to memory of 2144	2224	powershell.exe	29
PID 2224 wrote to memory of 2144	2224	powershell.exe	29
PID 2144 wrote to memory of 2668	2144	MSBuild.exe	30
PID 2144 wrote to memory of 2668	2144	MSBuild.exe	30
PID 2144 wrote to memory of 2668	2144	MSBuild.exe	30
PID 2144 wrote to memory of 2668	2144	MSBuild.exe	30

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\0446466ac12756312798acc282f43f42.ps1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 500
    3⤵
    - Program crash
    PID:2668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2144-13-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2144-15-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2144-19-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2144-21-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2144-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2144-16-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2144-17-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2144-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2144-25-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2144-23-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2224-11-0x0000000002B00000-0x0000000002B80000-memory.dmp

Filesize
512KB

Download
memory/2224-10-0x0000000002B00000-0x0000000002B80000-memory.dmp

Filesize
512KB

Download
memory/2224-9-0x0000000002B00000-0x0000000002B80000-memory.dmp

Filesize
512KB

Download
memory/2224-6-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

Filesize
9.6MB

Download
memory/2224-8-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

Filesize
9.6MB

Download
memory/2224-4-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/2224-5-0x00000000022D0000-0x00000000022D8000-memory.dmp

Filesize
32KB

Download
memory/2224-7-0x0000000002B00000-0x0000000002B80000-memory.dmp

Filesize
512KB

Download
memory/2224-22-0x000007FEF5730000-0x000007FEF60CD000-memory.dmp

Filesize
9.6MB

Download
memory/2224-12-0x000000001B550000-0x000000001B55A000-memory.dmp

Filesize
40KB

Download